---
layout: docs
page_title: Configure the QEMU task driver
description: Nomad's QEMU task driver provides a generic virtual machine runner that can execute any regular QEMU image. Review the QEMU task driver capabilities, plugin options, client requirements, and client attributes such as QEMU version. Learn how the QEMU task driver provides the highest level of workload isolation.
---

# Configure the QEMU task driver

Name: `qemu`

The `qemu` driver provides a generic virtual machine runner. QEMU can utilize
the KVM kernel module to utilize hardware virtualization features and provide
great performance. Currently the `qemu` driver can map a set of ports from the
host machine to the guest virtual machine, and provides configuration for
resource allocation.

The `qemu` driver can execute any regular `qemu` image (e.g. `qcow`, `img`,
`iso`), and is currently invoked with `qemu-system-x86_64`.

The driver requires the image to be accessible from the Nomad client via the
[`artifact` downloader](/nomad/docs/job-specification/artifact).

## Capabilities

The `qemu` driver implements the following [capabilities](/nomad/docs/concepts/plugins/task-drivers#capabilities-capabilities-error).

| Feature              | Implementation |
| -------------------- | -------------- |
| `nomad alloc signal` | false          |
| `nomad alloc exec`   | false          |
| filesystem isolation | image          |
| network isolation    | none           |
| volume mounting      | none           |

## Client Requirements

The `qemu` driver requires QEMU to be installed and in your system's `$PATH`.
The task must also specify at least one artifact to download, as this is the only
way to retrieve the image being run.

## Client Attributes

The `qemu` driver will set the following client attributes:

- `driver.qemu` - Set to `1` if QEMU is found on the host node. Nomad determines
  this by executing `qemu-system-x86_64 -version` on the host and parsing the output
- `driver.qemu.version` - Version of `qemu-system-x86_64`, ex: `2.4.0`

Here is an example of using these properties in a job file:

```hcl
job "docs" {
  # Only run this job where the qemu version is higher than 1.2.3.
  constraint {
    attribute = "${driver.qemu.version}"
    operator  = ">"
    value     = "1.2.3"
  }
}
```

## Plugin Options

```hcl
plugin "qemu" {
  config {
    image_paths    = ["/mnt/image/paths"]
    args_allowlist = ["-drive", "-usbdevice"]
  }
}
```

- `image_paths` (`[]string`: `[]`) - Specifies the host paths the QEMU
  driver is allowed to load images from.
- `args_allowlist` (`[]string`: `[]`) - Specifies the command line
  flags that the [`args`] option is permitted to pass to QEMU. If
  unset, a job submitter can pass any command line flag into QEMU,
  including flags that provide the VM with access to host devices such
  as USB drives. Refer to the [QEMU documentation] for the available
  flags.

## Resource Isolation

Nomad uses QEMU to provide full software virtualization for virtual machine
workloads. Nomad can use QEMU KVM's hardware-assisted virtualization to deliver
better performance.

Virtualization provides the highest level of isolation for workloads that
require additional security, and resource use is constrained by the QEMU
hypervisor rather than the host kernel. VM network traffic still flows through
the host's interface(s).

Note that the strong isolation provided by virtualization only applies
to the workload once the VM is started. Operators should use the
`args_allowlist` option to prevent job submitters from accessing
devices and resources they are not allowed to access.

## Next steps

[Use the Java task driver in a job](/nomad/docs/job-declare/task-driver/qemu).

[`args`]: /nomad/docs/job-declare/task-driver/qemu#args
[QEMU documentation]: https://www.qemu.org/docs/master/system/invocation.html
